2 ms·
If they have access to your database then they most likely can also get access to your source code.
by krainboltgreene 13y ago
If they have access to your database then they most likely can also get access to your source code.
- cschneid 13y agoThat wouldn't be the case in many scenarios I can think of: 1. DB backup is compromised (from an offsite backup storage, think S3). 2. Developer laptop lost, with a copy of the database locally. (source code may be available, but the site-specific key probably wouldn't be. As that's a config var on the server). 3. SQLi that dumps hashes to the page. I'm a big fan of making the job harder for attackers. There are lots of attack vectors where a 'pepper' value would be useless. But not all of them. And it's nearly free to implement. Might as well.